PreToolUse is the most powerful hook point. Every tool call flows through it, and the hook can allow, deny, defer, or rewrite the call before it executes.

What it does

The hook receives the tool name and arguments. Return values drive decision: allow the call as-is, deny with a reason, defer (ask the user), or modify (adjust arguments before execution). This is the extension point for custom policy engines, dynamic rewriting, and fine-grained safety controls.

When to use it

Enforcing "no Bash commands from this list" policies.
Rewriting edits to match house style automatically.
Auditing every tool call to an external system.
Deferring specific calls to a human reviewer even in auto mode.

Gotchas

Every tool call pays the hook's latency cost. Keep the hook fast.
Modifying arguments without telling the user can cause confusion. Log changes clearly.
A bad hook can block every tool call and wedge the session. Test in a throwaway session first.

Official docs: https://code.claude.com/docs/en/hooks.md#pretooluse